Privacy Policy

Our commitment

Jack Evelyn Pty Ltd (ACN 648 931 257, ABN 75 648 931 257) trading as Bold Health (“we”, “us”, “our”) respects your privacy.

As a small business we may not currently be legally bound by the Privacy Act 1988 (Cth). We have chosen to comply with it anyway, including the 13 Australian Privacy Principles (APPs). We think you are entitled to the same protection whoever you buy from.

This policy explains what personal information we collect, why, who we share it with, how we protect it, and how you can access, correct or complain about it.

1. You can deal with us anonymously

You can browse our website, read our articles and ask us general questions without telling us who you are.

If you want to place an order, manage a subscription or make a warranty claim, we need enough information to identify you and deliver your goods — we cannot complete a purchase anonymously.

2. What we collect

Information you give us

• Order details: name, delivery and billing address, email address, phone number.
• Payment details: we do not receive or store your full card number. Payments are processed by Shopify Payments and PayPal, who handle card data directly. We receive confirmation of payment, the card type and the last four digits.
• Account details: login credentials, order history, subscription preferences.
• Communications: emails, live chat and phone messages, and our replies.
• Reviews and photos you submit through Yotpo.
• Marketing preferences: whether you have opted in to email or SMS.
• Competition entries and any information required to enter.
• Affiliate details if you join our affiliate program, including payment details for commissions.

Information collected automatically when you visit

• Device and browser type, IP address, time zone, operating system.
• Pages viewed, products viewed, time on page, referring website and search terms.
• Video engagement on our shoppable video content.
• Cookies, pixels, tags and log files (see section 6).

Health information — please read

Our products are foods, and we do not ask you for health information. You do not need to disclose any health condition to buy from us.

Sometimes customers tell us about a health condition anyway — in a support email, a product review, or when reporting a reaction. Health information is “sensitive information” under the Privacy Act and gets extra protection:

• We collect it only where you volunteer it and it is reasonably necessary to help you.
• We use it only to respond to you, to handle a product safety issue, or where the law requires.
• We never use it for marketing, advertising targeting or audience building.
• We store it with restricted access and delete it when it is no longer needed.
• We may publish a review you submit, but we will remove health details about an identifiable person before publishing.

Please do not send us more health information than you need to. If you have a medical concern, speak to your doctor or pharmacist.

Children. Our website and products are for adults. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

3. Why we use your information

We use your personal information to:

• process and deliver your orders, and provide invoices and confirmations;
• manage your subscription, including renewals, reminders, pauses and cancellations;
• provide customer service and handle returns, refunds and complaints;
• verify your identity when you make a privacy or warranty request;
• detect and prevent fraud and misuse;
• send you marketing where you have opted in, and let you opt out at any time;
• publish reviews you have submitted;
• run competitions and promotions;
• understand how our website is used and improve it;
• measure how our advertising performs; and
• meet our legal obligations, including tax, food safety and consumer law.

We do not sell your personal information.

4. Automated decisions

We use some automated tools that can affect your order:

• Fraud screening. Shopify automatically assesses each order for fraud risk using details such as your IP address, billing and delivery address match, and payment history. A high-risk assessment may lead us to review, delay or cancel an order. A person always makes the final decision to cancel — it is never fully automatic.
• Automated workflows. We use Shopify Flow to trigger routine actions such as tagging orders and sending emails.
• Advertising segmentation. We use automated tools to group audiences for advertising. This does not affect your rights or your ability to buy from us.

You can ask for a human review. If an order was declined or delayed and you think it was wrong, email us and a person will look at it. Contact details are at the top of this policy.

5. Who we share your information with

We share personal information only with service providers who help us run the business, and only for that purpose. They are required to protect it and not use it for their own purposes.

We also use apps that handle inventory and product data only, and do not access your personal information (syncX: Stock Sync, WTE IDs Exporter, Search & Discovery, Section Store).

We may also disclose your information:

• where you have asked us to or consented;
• to our professional advisers, such as accountants and lawyers, under confidentiality;
• if we sell or restructure the business, to the buyer — on the condition they handle it under a policy at least as protective as this one. We will notify you if this happens; and
• where required or authorised by law — for example, a court order, a subpoena, or a lawful request from a regulator such as the ACCC, the OAIC or a food safety authority.

6. Cookies and tracking

What we use

• Essential cookies — keep you logged in and your cart working. The site cannot function without these.
• Analytics cookies — help us understand how the site is used.
• Advertising cookies and pixels — measure our ads and show you relevant ones.

Server-side tracking. We use wetracked.io, which sends information about your activity on our website to advertising platforms from our server rather than from your browser. It is important you know that this method can continue to work even when browser-based ad blockers or tracking-prevention settings are active. You can opt out of this through our cookie settings [CONFIRM: link once a consent tool is in place].

Meta Pixel and Conversions API. We share information with Meta Platforms about actions you take on our site, such as viewing a product or completing a purchase. This can include your email address in a hashed (scrambled) form. To be clear about what that means: hashing prevents us from sending your address in readable form, but Meta can and does match that hashed value to your account to measure and target advertising. Manage your preferences in Facebook’s ad settings.

Managing cookies. You can block or delete cookies in your browser settings, though some features may stop working. Learn more at www.allaboutcookies.org.

Opting out of ad targeting:

• Meta: facebook.com/settings/?tab=ads
• Google: adssettings.google.com
• Digital Advertising Alliance: optout.aboutads.info
• Your Online Choices (Australia): youronlinechoices.com.au

Do Not Track and Global Privacy Control. We do not currently change how we collect or use information when your browser sends a Do Not Track or Global Privacy Control signal. You can still manage tracking using the options above and your browser settings.

7. Marketing — and how to stop it

We only send marketing where you have opted in, or where you have bought from us and would reasonably expect to hear from us.

• Email: every email has an unsubscribe link. One click, no questions.
• SMS: reply STOP to any message.
• Or just tell us: email support@boldhealth.com.au and we will remove you.

We action opt-outs promptly and always within 5 business days, as the Spam Act 2003 requires.

Unsubscribing from marketing does not stop transactional messages you need — order confirmations, dispatch notices and subscription renewal reminders. To stop those, cancel your subscription or close your account.

You can ask us at any time where we got your details from, and we will tell you.

8. Sending information overseas

Several of our providers are based overseas or store data overseas. This means your personal information is likely to be disclosed to recipients in:

• Canada and the United States — Shopify, Meta, Google, PayPal
• United States — Omnisend, Appstle, UpPromote, Videowise, wetracked.io [CONFIRM]
• Israel and the United States — Yotpo
• European Union (Latvia) — Whatagraph [CONFIRM]
• Australia — SKUTOPIA and our delivery carriers

Before disclosing information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual protections. Overseas laws may differ from Australian law, and in some cases we may remain accountable for how an overseas recipient handles your information.

If you order from outside Australia, your information will be transferred to and stored in Australia.

9. How we keep your information safe

We take reasonable steps to protect your information from misuse, loss and unauthorised access, including:

• encryption of data in transit (HTTPS across the site);
• tokenised payment processing — we never hold full card numbers;
• restricting admin access to those who need it, with individual accounts;
• multi-factor authentication on our Shopify admin account;
• regularly reviewing the apps and integrations connected to our store, and removing those we no longer use along with any data they hold; and
• choosing reputable providers who maintain recognised security standards.

No system is completely secure, and we cannot guarantee absolute security. But if something goes wrong, we will act — see below.

10. If there is a data breach

If we suspect a data breach, we will assess it promptly.

If a breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme. We will tell you what happened, what information was involved, and what you should do.

11. How long we keep your information

When information is no longer needed and we are not required to keep it, we destroy or de-identify it.

A note on deletion requests: we cannot always delete everything on request. Tax law requires us to keep transaction records for seven years. Where that applies we will tell you, restrict the information to legal use only, and delete the rest.

12. Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete.

• Email support@boldhealth.com.au or write to us at the address above.
• We may ask you to verify your identity, to make sure we do not give your information to someone else.
• Access is free. If a request is unusually complex we may charge a reasonable cost, but we will tell you before we do.
• We will respond within 30 days.
• If we refuse access or correction, we will explain why in writing and tell you how to complain.

You can also see and update much of your information yourself by logging into your account.

13. Making a privacy complaint

If you think we have mishandled your personal information, please tell us — we would like the chance to fix it.

• Contact our Privacy Officer at support@boldhealth.com.au, marking your email “Privacy”, with details of what happened.
• We will acknowledge your complaint within 5 business days.
• We will investigate and respond within 30 days. If we need longer, we will explain why and keep you updated.

If you are not satisfied, you can contact the Office of the Australian Information Commissioner:

• www.oaic.gov.au
• 1300 363 992
• GPO Box 5218, Sydney NSW 2001

Nothing in this policy prevents you from complaining to the OAIC at any time.

14. Third-party websites

Our website links to other sites, and our products are sold through marketplaces and stockists. We are not responsible for their privacy practices. Please read their policies before giving them your information.

15. Changes to this policy

We may update this policy to reflect changes to our practices, our providers, or the law. The current version is always on this page with its effective date.

If we make a change that significantly affects how we handle your information, we will tell you by email or a notice on the website before it takes effect.

16. Contact us